release: split the Play key write, guard the tag and attach the mapping

- write the Play service account in its own step so fastlane never has
  the secret in its environment (only the 0600 file path)
- fail the build when the tag does not match versionName
- serialize releases with a concurrency group
- attach the R8 mapping.txt to the GitHub release

.github/workflows/release.yml

@@ -5,6 +5,10 @@ on:
     tags:
       - "v*"
 
+concurrency:
+  group: release
+  cancel-in-progress: false
+
 permissions:
   contents: read
 
@@ -20,6 +24,16 @@ jobs:
       - uses: actions/checkout@v7
         with:
           persist-credentials: false
+      - name: Check tag matches versionName
+        run: |
+          version=$(grep -oP 'versionName = "\K[^"]+' app/build.gradle.kts)
+          case "$GITHUB_REF_NAME" in
+            "v$version" | "v$version"-*) ;;
+            *)
+              echo "tag $GITHUB_REF_NAME does not match versionName $version" >&2
+              exit 1
+              ;;
+          esac
       - id: build
         uses: ./.github/actions/build
         with:
@@ -70,13 +84,16 @@ jobs:
           fi
       - name: Check release notes exist
         run: test -f "metadata/en-US/changelogs/${{ needs.build.outputs.version-code }}.txt"
-      - name: Upload to Google Play
+      - name: Write Play service account
         if: steps.stable.outputs.value == 'true'
         env:
           PLAY_SERVICE_ACCOUNT_JSON: ${{ secrets.PLAY_SERVICE_ACCOUNT_JSON }}
         run: |
           umask 077
           printf '%s' "$PLAY_SERVICE_ACCOUNT_JSON" > "$RUNNER_TEMP/play.json"
+      - name: Upload to Google Play
+        if: steps.stable.outputs.value == 'true'
+        run: |
           nix develop .#release --command fastlane supply \
             --aab dist/bundle/release/app-release.aab \
             --package_name com.subtracks \
@@ -127,4 +144,4 @@ jobs:
           if [ "${{ steps.stable.outputs.value }}" != "true" ]; then
             args+=(--prerelease)
           fi
-          gh release create "$GITHUB_REF_NAME" subtracks.apk subtracks.aab SHA256SUMS dist/release-certificate.pem "${args[@]}"
+          gh release create "$GITHUB_REF_NAME" subtracks.apk subtracks.aab SHA256SUMS dist/release-certificate.pem dist/mapping/release/mapping.txt "${args[@]}"

signing/README.md

@@ -18,7 +18,7 @@ The APK and the AAB are signed with the release key. Certificate SHA-256:
 02da2cb7b8214e53bdbfb455698dcb965222f91c954b5210aeac96fe329c8f01
 ```
 
-Each release attaches the APK, the AAB, the checksums and the certificate (committed here as [`release-certificate.pem`](release-certificate.pem)):
+Each release attaches the APK, the AAB, the checksums, the certificate (committed here as [`release-certificate.pem`](release-certificate.pem)) and the R8 `mapping.txt`:
 
 ```sh
 sha256sum -c SHA256SUMS